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Abstract 

The theory of fault-tolerant quantum computation guarantees correct quantum computations 
when errors are "physically natural". What happens if the nature has an "intelligence", and 
attacks our quantum computers with precisely tuned "artificial" errors? Here, we show that the 

Si ; 

Q-i no-signaling principle and the topological quantum error correcting code enable an exponentially 

small probability of being fooled by such an intelligent nature. 
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The fault-tolerant quantum computation [l| is one of the most successful theories in 
modern quantum physics. It guarantees correct quantum computing in noisy environments 
assuming that errors are "physically natural", e.g., weak, uncorrelated, random, or homoge- 
neous, etc. However, the nature might be cleverer than we think: once we build a scalable 
quantum computer, she might attack our quantum computer with precisely tuned "artifi- 
cial" errors to prohibit our access to the powerful quantum world. The nature might even 
use an attack based on a "super quantum theory". Is it possible to protect our quantum 
computer from such an intelligent nature? 

In order to study such a problem, let us consider the measurement-based quantum com- 
putation between two people, Alice and Bob. The measurement-based quantum computa- 
tion 2I is a new model of quantum computing: once a special quantum many-particle state, 
which is called a resource state, is created, universal quantum computation can be done 
only with local measurements of each particle. The resource state itself is independent of 
algorithms, and a specific algorithm can be run by changing measurement angles of each 
qubits. In our setup (Fig. CD), Bob first prepares a resource state (Fig. CD (a)), and next sends 
each particle to Alice one by one (Fig. [TJ(b)). Alice measures each particle in a certain angle 
which is determined by the algorithm in her mind (Fig. [U(b)). The algorithm is kept secret 
to Bob. If Bob behaves honestly, i.e., if he just keeps the resource state in his quantum 
memory and carefully sends each qubit to Alice, errors in this quantum computation are 
"physically natural" , and therefore Alice obtains the correct outcome of the computation as 
long as the noise level is below the threshold. (For example, the threshold is 7.5 x 10~ 3 if Bob 
creates the Raussendorf-Harrington-Goyal lattice 3, J], which is a specific resource state for 
the topological measurement-based quantum computation {3], 4].) However, if Bob has an 
intention of fooling Alice, he might apply some precisely tuned operations on the resource 
state. (Or even he might prepare a completely different state and send some particles of 
it to Alice.) In this case, Alice may no longer be able to obtain the correct outcome. In 
particular, a logical bit of Alice's computational register might be secretly flipped by Bob, 
and she might proceed her computation without noticing it. 

Can Alice check the correctness of this two-party computation with such an evil Bob? In 
this paper, we propose two simple schemes which make the probability of Alice being fooled 
by Bob exponentially small. Interestingly, these schemes are obtained by combining two 
different concepts from different fields: the no-signaling principle js| from the foundation of 
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FIG. 1: Our setup, (a) Bob prepares a resource state, (b) Bob sends each particle to Alice one 
by one, and Alice measures each particle according to her algorithm. 

physics and the topological quantum error correcting code j^l, ^, 6] from a practical appli- 
cation in quantum information. The no-signaling principle means that a shared quantum 
(or more general) state cannot be used to transmit information. It is one of the most cen- 
tral principles in physics, and known to be more fundamental than quantum physics (i.e., 
there is a theory which is more non-local than quantum physics but does not violate the 
no-signaling principle ij]). The topological quantum error correcting code is a specific type 
of the quantum error correcting code which cleverly uses the topological property of string 
operators to globally encode logical states. 



RESULTS 



A. Topological measurement-based quantum computation 



Let us quickly review the basics of the topological measurement-based quantum compu- 
tation {si y, Is], which are necessary to understand results of this paper. The Raussendorf- 
Harrington-Goyal state \RHG) is the three-dimensional graph state with the elementary 
cell given in Fig. [2] (a). Defects are created by Z measurements on \RHG), and topological 
braidings of defect tubes can implement some Clifford gates. Non-Clifford gates are imple- 
mented by the magic state preparation and distillation Q. A string of Z operators which 
has at least one open edge is an error, and its edge(s) is detected by syndrome measurements 
of cubicles of X operators (Fig. 12(b)). A string of Z operators which connects or surrounds 




FIG. 2: The topological measurement-based quantum computation, (a) The elementary cell of the 
Raussendorf-Harrington-Goyal state. Yellow circles are qubits, and red bonds are CZ gates, (b) 
The error detection. Red strings are errors. Blue cubicles are syndrome operators, (c) Undetected 
errors or logical operations. Green tubes are defects. Red strings are strings of operators, which 
connect or surround defects. 



B. The first scheme 

Let us explain our first scheme. Alice defines the iV-qubit state 

|tf P ) = P(\RHG') ® |+)^/ 3 ® |O) 07V/3 ), 

where \RHG') is the iV/3-qubit Raussendorf-Harrington-Goyal state {3, 4] with sufficiently 
many magic states being already distilled, |+) = -75GO) + |1)), and P is an iV-qubit per- 
mutation, which keeps the order of qubits in \RHG') state. This permutation is randomly 
chosen by Alice and kept secret to Bob. 

Bob prepares a universal resource state, and sends each qubit of it to Alice one by one. 
Alice measures each qubit until she creates the iV-qubit state a q \^>p) in Bob's laboratory, 
where 

N 
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with q = (xi, ...,xn,Zi, ...,Zn) £ {0, 1} is the byproduct of the measurement-based quan- 
tum computation [2j. Here, Xj and Zj are Pauli operators acting on jth qubit. Throughout 
this paper, we assume that there is no communication channel from Alice to Bob. Then, due 



to the no-signaling principle, Bob cannot learn anything about q and P {9]. If Bob can learn 
something about P, Alice can transmit some message to Bob by encoding her message into 
P, which contradicts to the no-signaling principle. Furthermore, if Bob can learn something 
about q, Alice can exploit this fact to transmit her message to Bob. 

Bob sends each qubit of a q \^p) to Alice one by one. Alice does the topological 
measurement-based quantum computation on a q \^fp) with correcting a q . This means that 
before measuring jth qubit of a q \^p) she applies a q \j on jth qubit, where a q \j is the restric- 
tion of ert on jth qubit. For example, (I (g) XZ ® Z)\ 2 = XZ. Qubits belonging to \RHG') 
are used for the top olog ical measurement-based quantum computation. States |0) and |+) 



are used as "traps" [10[. In other words, she measures Z on |0) and X on |+), and if she 
obtains a minus result, she aborts the protocol. If results are plus for all traps, she accepts 
the result of the topological quantum computation. 

Since Bob might be dishonest, he might deviate from the protocol. His attacks before 
creating <j q \typ) is summarized as a creation of a different state p. If he is honest, p = 
a q \fy p)(ty p\a q . If he is not honest, p can be any state, since he can first behave honestly 
to create a q \^p), and then replace it with a completely different state p. However, for 
any iV-qubit state p, there exists a completely-positive-trace-preserving (CPTP) map which 
satisfies 

p = Y i E j a q \Vp)(* P \alE} t 
j 

where Ej = J2 a ^f 17 "' ^ s a Kraus operator of the CPTP map, and C° is a complex number 
(see Methods). Since 

1 = 

we obtain £\ £ Q |qf = 1. 
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Bob does not know q. Hence, from his view point, 

= ^|c;|V a |^p}^ P |at 



= ^C a <T a \*p)(*p\(Tl (1) 

a 

where C a = J2j | 1 2 an d 

a a j 

Here, we have used the following equations Q| 

^a\a a a q pa\ala q = (2) 

<i 

for any p and a ^ f3. The second equation is easy to show. For a proof of Eq. (|2J), see 
Methods. 

Bob's attacks after creating p can also be included in the preparation of p. This is 
understood as follows. Let us assume that, after creating p, Bob sends a subsystem S\ of p to 
Alice, and then Alice measures all particles of Si. After this Alice's measurement, Bob might 
apply an operation on another subsystem S2 of p which has not been sent to Alice. However, 
Bob cannot know Alice's measurement angles and results on Si due to the no-signaling 
principle, and therefore Bob's operation on S% is independent of Alice's measurements on 
Si. Furthermore, Bob's operation on 5*2 commutes with Alice's measurements on Si. Hence 
we can consider as if Bob applied such an operation on S2 immediately after he preparing 

P- 

In short, we can assume that Bob's attack is a random Pauli attack on the correct state 
as is shown in Eq. ([1]). Hence let us focus on a a \^p). For the topological quantum error 
correcting code, if the weight |a| of a a is less than a certain integer d, then such an error 
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does not change logical states n n n . Il0|. Here, d is determined by the defect thickness and 
distance between defects. The weight |a| of a a means the number of nontrivial operators 
in a a . (For example, the weight of I Cg> XZ <g> Z ® I cg> X is 3.) Therefore, in order for a a 
to change a logical state of the computation, \a\ must be larger than d. (To understand it, 
let us consider a simple example. If we encode the logical as |0^) = 1 000) and the logical 
1 as = | HI), we must flip three qubits to change the logical state. A single bit flip is 
detected and corrected when the majority vote is done.) 

Alice randomly chooses a permutation P. In this case, the probability of P^a a P not 
changing any trap is at most (I)'"'/ 3 . (For a calculation, see Methods). Therefore, the 
probability that the logical state is changed and no trap is flipped is at most 

/r>\ M/3 / 9 \ d/3 

< £c„ 

H>d V 7 V 7 \a\>d 

9 \ d/3 

Here, we have said "at most" , since the above sum includes the contribution from a a which 
has a weight larger than d but does not contain any logical error. 

C. The second scheme 

Let us explain our second scheme, which does not use any trap. Alice randomly chooses 
k = (hi, h N , ti, ...,t]y) G {0, 1} 2N , and defines the iV-qubit operator 

N 



where T = |0)(0| + «|1)(1| and H is the Hadamard operator. Note that T^XT = —iXZ, 
T^ZT = Z, and T^XZT = -iX. Next, Alice defines the iV-qubit state \^ k ) = K k \RHG'), 
where \RHG') is the iV-qubit Raussendorf-Harrington-Goyal state (3, 4] with sufficient num- 



ber of magic states being already distilled 



1] 



Bob prepares a universal resource state, and sends each qubit of it to Alice one by one. 
Alice does measurements and creates cr q \^>k) in Bob's laboratory, where a q is the byproduct 
of the measurement-based quantum computation. Due to the no-signaling principle, Bob 
cannot learn k and q. Bob sends each qubit of <J q \^>k) to Alice one by one, and Alice does 



7 



her topological measurement-based quantum computation with correcting a q Kk- If Alice 
detects any error, she aborts the protocol. 

Again, because of Eq. (1T1), we can assume that Bob's attack is a random Pauli attack. 
Therefore let us focus on cr a \^k)- in order for a a to change a logical state without being 
detected by syndrome measurements, a a must contain at least one string s a of operators 
which connects or surrounds defects (Fig. [2] (c)) 4, 6]. Since Alice randomly chooses k, 
the probability that all operators in K\s a K k become Z or XZ operators is at most 
where \s a \ is the weight of s a . Note that \s a \ > d because it connects or surrounds defects. 

Hence, the probability that the logical state is changed and Alice does not detect any 
error is at most 

\a\>d V 7 V 7 \a\>d 

<- c ' 

II. DISCUSSION 

The question, "can Alice check Bob?" , considered in this paper has not only fundamental 
but also practical importance. When a scalable quantum computer is realized, it will be 
used in "cloud computing" style, since only limited number of people will be able to possess 
it. In such technologically limited client will delegate her quantum computation 

to a server who has a fully-hedged quantum computer. A client who pays huge amount 
of money to a company offering a quantum computing service should want to check their 



a. 



quantum computation 

Such a problem is called "verification" and has been studied in the field of blind quantum 



computation 



151 ] . Blind quantum computation is a secure quantum computing protocol 
which enables Alice who does not have sufficient quantum technology at her disposal to 
delegate her quantum computation to Bob who has a full-fledged quantum computer. There 
are three important requirements for blind quantum computation: correctness, blindness, 
and verifiability. The correctness means that if Bob is honest, Alice obtains the correct 
outcome. The blindness means that whatever Bob does, he cannot learn Alice's input, 
output, and algorithm. The verifiability means that Alice can check whether Bob is doing 
correct quantum computation. 
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The blind quantum computation protocol by Broadbent, Fitzsimons, and Kashefi 
(BFK) 11], which uses the measurement-based quantum computation enabled for the 
first time the unconditional security for Alice who has only a device which emits single-qubit 
states. It was shown that BFK protocol satisfies the correctness, blindness, and verifiabil- 

ity y . 

Verification was also considered by Aharonov, Ben-Or, and Eban (ABE) [8| in the context 
of the quantum interactive proof system. They used the circuit model encoded with the 
quantum polynomial error correcting code. 

Recently, another protocol of blind quantum computation, so-called the "measuring Alice 
blind quantum computation" (MABQC), was proposed by Morimae and Fujii It can 
be considered as a complementary protocol to the BFK type, since in MABQC protocol 
Alice does measurements instead of state preparations. The idea of MABQC is simple: Bob 
prepares a resource state, and sends each particle to Alice one by one. Alice measures each 
particle according to the algorithm in her mind. Honest Bob creates the correct resource 
state, and therefore the correctness is trivially guaranteed. The blindness holds due to the 
no-signaling principle js, 9]. Furthermore, the device independence 16] is also assured {9]. 
(The device independence means that Alice does not need to trust her measuring device. 
By the definition of the no-signaling principle, Bob cannot learn anything even if Alice's 
device does some strange measurements.) One open problem about MABQC had been the 
verifiability. 

In terms of blind quantum computation, our two schemes presented in this paper are 
considered as verification schemes for MABQC. In particular, the first one is considered as a 
generalization of FK verification to MABQC. The second one is, interestingly, considered as 
a hybrid of FK verification and ABE verification. Like FK, we use the topological quantum 
error correcting code (3), 0, Q] to increase the weight of Bob's attacks. However, we use the 
topological code in a different way by using the idea of the "random local basis change", 
which is inspired by ABE. Because of the no-signaling principle, our proofs are simpler than 
those of FK and ABE. 

Since Alice aborts the protocol when she detects the flip of a trap or an error, honest 
but imperfect Bob can be also ruled out. However, in the first scheme, the probability 
that an error whose weight is larger than d changes only few traps is still exponentially 
small. Furthermore, in the second scheme, each physical qubit can be encoded with an 
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error correcting code 81. Therefore, "physically natural" errors and "artificial" errors can 

n n 

be distinguished to some extent |8|,H0[. 

The crucial point of our schemes that Bob cannot learn q, P, and k is based on not 
quantum physics but the no-signaling principle. Therefore, it might be true that we can 
protect our quantum computing from the nature which uses "super quantum" attacks. To 
show it would be an interesting subject of a future study. 

Acknowledgements The author acknowledges Vedran Dunjko and Keisuke Fujii for 
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III. METHODS 



A. Existence of a CPTP map 

Let {|0fc)}| = i be any orthonormal basis of the iV-qubit Hilbert space. We diagonalize 
the iV-qubit state p as p = J2j=i Let us take Ej k = \/\j\\j){(j>k\- Then for any 

iV-qubit state rj = Y. a ,pVa(3\<Pa)(<Pi3\, 

^E jk r)E] k = \AiV / ^i^/3l A i)(^fc|0 Q )(0/3|0fe)(A i | 

j,k j,k,a,f3 

= Aj-?7fcfc| Aj) (Aj-| 
= P- 

Furthermore, 

E E W = EVW^>< A ;i A ;><^i 

3,k j,k 
= I. 



B. Proof of Eq. © 

For the convenience of readers, we here 
there exists an index j such that a a \j ^ 
take S G {X, Z} such that S anticommutes 



give the proof [8j of Eq. (j2J). Since a ^ (3, 
j. For any such a a \j and crp\j, we can always 
only one of a a \j and (Tg\j. Let us define Q = 
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J®- ? '~ 1 <g> 5 ® J®^-J. Then, 

= ^(^QVa(Q^>(^QVi(Q^) 
C. Probability of avoiding traps 

Let a, b, c be the number of j such that cr a |j = X, Z, XZ, respectively. Since |a| = 
a + b + c < 3 max(a, 6, c), we obtain max(a, 6, c) > 

Let us assume max(a, b, c) = a. Then, the probability that all X operators of a a do not 
change any trap is 

(n - ay.nZlC^ - k) = (2y uV (N-ik) 

m W UVo(N-k) 




<-(! 

This is larger than the probability that a a does not change any trap. 

We can obtain the same result for max(a, b, c) = b. For max(a, b, c) = c, we have only to 
replace | with |. 
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